Researchers recently found a vulnerability in the way DNS resolvers handle DNSSEC validation that allow attackers to DoS resolvers with a single DNS request
https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
It is highly recommended to upgrade your resolvers to the following versions:
- unbound: 1.91.1
- PiHole: FTL 5.25 or Docker 2024.02.0
- Bind9: 9.19.17
- dnsmasq: 2.90
- and probably any other resolver you use
Wouldn’t the attacker have to be on the same network as the resolver for this to work? Or could it be triggered by a “dirty hostname”? Because in the former case, most home networks would not be at much risk.
It’s the latter. Unless you run your own DNS resolver, most people are safe